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Abstract 

Multi Prover Interactive Proof systems (MIPs) were first presented in a cryptographic context, 
but ever since they were used in various fields. Understanding the power of MIPs in the quantum 
context raises many open problems, as there are several interesting models to consider. For example, 
one can study the question when the provers share entanglement or not, and the communication 
between the verifier and the provers is quantum or classical. While there are several partial results 
on the subject, so far no one presented an efficient scheme for recognizing NEXP (or NP with 
logarithmic communication), except for [KM03], in the case there is no entanglement (and of course 
no communication between the provers). 

We introduce another variant of Quantum MIP, where the provers do not share entanglement, 
the communication between the verifier and the provers is quantum, but the provers are unlimited 
in the classical communication between them. At first, this model may seem very weak, as provers 
who exchange information seem to be equivalent in power to a simple prover. This in fact is not the 
case — we show that any language in NEXP can be recognized in this model efficiently, with just two 
provers and two rounds of communication, with a constant completeness-soundness gap. 

The main idea is not to bound the information the provers exchange with each other, as in the 
classical case, but rather to prove that any "cheating" strategy employed by the provers has constant 
probability to diminish the entanglement between the verifier and the provers by a constant amount. 
Detecting such reduction gives us the soundness proof. Similar ideas and techniques may help help 
with other models of Quantum MIP, including the dual question, of non communicating provers 
with unlimited entanglement. 
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1 Introduction 



Multi Prover Interactive Proofs (MIPs) have been studied extensively in the classical setting, and 
provide an exact characterization of NEXP [BFL92J. Extending MIPs to the quantum setting poses 
many important open problems, and may give us more intuition regarding the power of entanglement. 
There are several possible generalizations for quantum multi-prover schemes, which differ in the power 
of the verifier (which can be quantum or classical), and in the relation between the provers (for example, 
how much entanglement they have). The first results for this problem were given by Kobayashi and 
Matsumoto [KM03]. They proved that as long as the provers share a bounded (polynomial) amount of 
entanglement, the set of languages which can be recognized is contained in NEXP (even if the verifier 
is quantum). 

We do not understand the power of the model when the verifier is classical and the provers share 
(limited or unlimited) entanglement. In particular, Cleve et al. [CHTW04J provide examples where the 
proof is valid if the provers share no entanglement, but is no longer sound when they do. Preda [Pre] 
showed that if the provers are not limited to quantum entanglement, but instead have an unlimited 
amount of nonlocal boxes [PR97], then the set of recognizable languages is contained in EXP. 

There are also some positive results when the provers are quantum. Cleve et al. CdJOT provide 
a proof system for NP when the verifier is classical and the provers who share an unlimited amount of 
entanglement. The proof scheme provides a constant gap, but the communication is linear. Kempe et 
al. (KKMTV07) give a quantum protocol for recognizing languages in NP by a quantum verifier with 
logarithmic communication, when the provers share unlimited entanglement. However, when x ^ L the 
probability that the verifier will discover this is 1 — 0(l/n), which means that it is necessary to repeat 
the protocol a polynomial number of times to get constant soundness. Ito et al. [IKPSY07J use this 
result, and give a 3 prover proof system for NEXP which is resistant to entanglement with soundness 

of just i-2- pol y. 

1.1 Our Results 

An important assumption underlying the work on multi prover schemes is that the provers are not 
allowed to pass information between themselves. The results of [KWOO, Pre] could lead us to believe 
that a proof system with a quantum verifier and two provers who can pass classical information between 
them is limited to EXP. Surprisingly, this is not the case (assuming EXP ^ NEXP). We show that: 

Theorem 1.1. Let V be a polynomial time verifier that can exchange quantum messages with two 
computationally unbounded provers. The provers share no entanglement, but can freely communicate 
classically between them. Then for any L £ NEXP there is a two round protocol for the verifier and 
provers such that for any string x 

• (completeness) If x £ L then there are two prover strategies such that V will accept x with 
probability 1. 

• (soundness) If x ^ L then for any two prover strategies the probability that V will accept x is at 
most c for some constant < c < 1. 
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The communication between the verifier and the provers is is polynomial in the length of the inpu, 



We note that augmenting the provers in our model with unlimited entanglement gives something 
which is contained in EXP [KWOOJ (as this is equivalent to quantum communication and thus to a 
single quantum prover). Bounding the verifier to be classical, would limit us to languages in PSPACE 
[Sha90i] (as in this scenario is equivalent to a single prover and a classical verifier), so both conditions 
are necessary. This problem is in a way dual to the scenario where the provers do not have any means 
of communication but instead have unlimited entanglement, where much less is known. 

Quantum MIPs are thought to be a model of computation which may give us better understanding of 
entanglement, and its powers. Surprisingly, our result, which is stated in a model with no entanglement 
between the provers, is based on following the entanglement between the provers and the verifier. 
Each message the verifier sends is a superposition of two classical queries. Measuring the message 
would ruin the superposition, and will be caught by the verifier. However, a strategy which does not 
measure it "enough" does not extract enough useful classical information, and prevents the provers from 
coordinating answers via the classical channel. Most of the paper follows the amount of entanglement 
between the verifier and the provers during the protocol, making sure that either the provers do not 
extract enough information to answer with very high probability (we note that from an information- 
theoretic point of view they extract many bits of information-so we use tailored bounds), or they have 
some chance of getting caught. 

1.2 Related Work 

It is interesting to view the results of this paper in light of the complexity class QMA(2), defined 
by Kobayashi, Mastumoto and Yamakami [KM YOl] . Intuitively, this is the class of languages which 
can be recognized by a quantum verifier with two unentangled bounded pieces of quantum evidence. 
While there is no classical analog for this problem (having two classical witnesses is still NP), there is 
evidence that QMA(2) strictly contains QMA }LC V07] . Blier and Tapp [BT07] showed that a verifier 
can recognize an NP complete language with soundness 1— 0(l/n 6 ). A constant soundness completeness 
gap in their results would imply our own. We note however, that Aaronson et al. [ABDFS08J give 
evidence towards QMA(2)CPSPACE, and therefore we do not expect that this is the case. 

The idea of using Private Information Retrieval [CGKS951 IKdW03j IKdW04| schemes (PIRs) has 
been suggested by Cleve et al. }CGJ07j . Our protocol is in a sense a cheat sensitive PIR where 
the verifier can check whether the prover has tried to learn information. A similar quantum PIR 
scheme has been independently presented by |GLM07j in a different context. It is important to note 
that information disturbance tradeoffs proposed by such quantum PIR schemes are by themselves 
insufficient to prove the soundness of our multi-prover protocol, since the leakage of even a small 
amount of information might enable the provers to succeed in cheating the verifier. 

1 Equivalently we can state our result for NP, bounding the communication to be logarithmic. 
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2 Preliminaries 



We assume the reader is familiar with quantum computation (see [NCOO] for example). 

Let L E NEXP. By standard PCP machinery, we can assume that given x the verifier has an implicit 
efficient access to an exponentially long 3-SAT formula <£, such that if x £ L then <& is satisfiable, and 
otherwise any assignment can satisfy at most a 1 — 7 proportion of the clauses for some constant 7 > 0. 
We can also assume that each variable appears exactly 5 times, and each clause contains three different 
variables. Let C denote the set of clauses and V the set of variables. If a variable v G V appears in a 
clause cede write v £ c. Let M = \C\ denote the number of clauses and N = \V\ the number of 
variables. Let T be a truth assignment for <F For a variable x £ V, let T(x) denote the value T assigns 
x. For a clause y £ C, if y contains the variables u^, vf, uf, let T(y) = T(vf), T^), T{y%). 

Alice (Bob) has a private Hilbert space H V A (M), with some finite arbitrarily large dimension d (we 
assume without loss of generality that the dimensions are identical). The messages between Alice (Bob) 
and the verifier will be sent by passing a state which is in a Hilbert space H™ (H B ). For convenience, 
we partition the private Hilbert space of the verifier into three parts, H v = H^ nx £g> H V A (g) H B . The 
Hilbert spaces H\, H V B will be used with messages sent to different provers, but they are private spaces 
that belong to the verifier. We let the verifier send and receive classical messages from Alicd. For the 
protocol we present, the dimensions of the Hilbert spaces used are dim(//™) = 8M, which would fit 
a clause y and T(y), dim(H A ) = M, dim(H B l ) = 2N which would fit a variable and the value it is 
assigned, and dim(H B ) = N. 



3 Algorithm 

Let 7T be a probability distribution which chooses two clauses y, y uniformly at random from C, and 
two variables x, x uniformly at random from V, with the constraint that x appears in y (x does not 
necessarily appear my). 
Protocol for verifier 

1. Sample ir to get y,y,x,x. Generate the states on 0(log(iV)) qubits 

7^(|yy) + \yy)) ® |ooo> eH\ 

-^(\xx) + \xx)) ® |0> £H V B ®H% 
v2 

Send Alice (Bob) the message space H™ (H B ), which consists of the last m + 3 (n + 1) qubits. 

2. Let T be a satisfying assignment for $ (if one exists). Alice should apply the unitary which takes 
|c) (g> 1 000) — > |c) (%> \T(c)) for any clause c £ C, and Bob should apply the unitary which takes 

2 This can be done by using a larger space -ff^ 1 , with the verifier measuring the part of the space which should be used 
for the classical message. Thus, this does not change the model, and is only done for clarity. 
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\v) (8> |0) — > \v)\T(v)) for v S V. In fact the provers apply any Local Operations and Classical 
Communication protocol they want among themselves. Finally, Alice (Bob) returns the verifier 
the message space H™ (Hg). 

3. Send Alice the classical values y,y,x,x. Alice returns 8 bits: T(y),T(y),T(x),T(x). If Alice 
returned quantum values, the verifier measures them according to the standard basis. 

4. Verify that the clause y is satisfied, and that T(x) matches T(y). Perform the SWAP test 
[BCVVWOlj between the state in E\ ® H% and -^(\yy) ® \T(y)) + \yy) (g> \T(y)) and between the 

state in K V B ® Hg and -j={\xx) ® \T(x)) + \xx) ® \T{x)). Accept if all tests passed. 

Note that the verifier does not generate any entanglement between the provers. This means that it is 
possible to repeat the protocol in order to reduce the error probability. 

Completeness: With a common satisfying assignment the provers can apply the required quantum 
transformation, and all the tests will be passed with probability 1. 

4 Soundness of the Protocol 

Intuition To simplify the analysis, we modify the protocol. First, we purify the verifier. This will 
enable us to talk about the probability of a set of queries given measurements by the provers. The 
second modification will be to strengthen the provers, allowing them to perform any joint separable 
measurement instead of Local Operations and Classical Communication (LOCC), which will enable us 
to write the state after their actions. We prove that the provers have a constant failure probability 
for any result k of the separable measurement they make. We begin by finding an estimate for the 
probability that the verifier measures (y, X^j clS £L function of the provers' result k. Next, we show 
that if k is more probable given a clause y\ then given another result y%, and the verifier measured 
(y%, y2,x,x) for any x,x, then there is constant probability that Alice fails the SWAP test (because 
such a measurement operator diminishes the entanglement between H\ and H™). 

We then show that either the measurement has a constant probability to diminish the entanglement, 
or after it there is still a large set of clauses (and variables which appear in them) which are all "almost 
uniformly" probable. The set will be large enough that no assignment will satisfy all of it. This 
means that if the provers succeed with very high (but constant) probability, they must succeed on a 
large portion of this "uniform" set, and thus they must succeed on a very large number of clauses and 
variables. This will give a strategy for the classical protocol which has success probability greater then 
1 — 7/3, which is a contradiction. 

The Modified Protocol As stated above, the first modification is to purify the sampling of n, 
postponing it until after the provers act on the information. It uses H^ nx with dim(#J ux ) = M 2 N 2 . 
The verifier generates 

i>*= \yy,xx)®^(\yy) + \yy))®\000)®^(\xx)+\xx))®\^ G H^H^H^H^H^ 



4 



As before, the verifier sends Alice (Bob) the Hilbert space (H^). After Alice and Bob act on the 
message spaces they get and return H^, H^, the verifier measures if^ ux to get y, y, x, x and sends them 
to Alice as in Protocol 1. This modification does not change the cheating power of the provers (they 
cannot tell what protocol is being used). 

The second modification is to replace the LOCC done by the provers in the first stage with a single 
joint separable measurement. [BDF + 98 BNS97] proved that this is strictly stronger than LOCC. In 



particular they showed how to transform any LOCC protocol into such a measurement. As the provers 
are not entangled, we can assume that their private spaces are initialized with the state |0 . . . 0). Letting 
P = I^ttK^ttI) the provers' operation now becomes applying a measurement with operators 

(I M 2 N 2 ® I M ® A k ® I N <g> B h y(I M 2 N 2 <g> I M <8> A k ®I N ® B k ) 
where I p is the p x p identity matrix, A k is an 8Md x 8Md matrix, B k is a 2Nd x 2Nd matrix and 

Y,( A k ® B k )\A k ® B k ) = I 16NMd 2 

k 

The Hilbert spaces H^, are then returned to the verifier. 

We now calculate the probability that the verifier measured values r = (y,y,x,x), conditioned 
on the fact that the measurement result was k. Denote A k (y) = tr(A k (\y){y\ (8) I)A k ), where we are 
tracing over the private qubits of the prover and the qubits which define the assignment, and similarly 
B k (x) = tr(B k (\x)(x\ (8> I)x k ). In Appendix [Al we prove that for y / y, x ^ x 

p ( ~ ~ Xh , (A(y)+A(y))(B(x) + B(x)) 

Pr(y, y, x,x\k) = -, , tttt (1) 

E c ,ce^ec,ceV Pr (c, c,v,v\k) 

where if y = y the numerator changes to 4A(y)(B(x) + B{x)), and similarly for x,x. 
We give some intuition for Equation (TT]). The numerator is the product of two factors, because when 
the verifier measures before the provers (which is physically equivalent) the provers are unentangled, 
and therefore the probability of k is just the tT(A k pA^ k ) ■ ti{B k pB^ k ). Alice's factor is composed of two 
terms, because tracing out the verifier Alice just gets a mixed state of \\y){y\ + \ \y){y\. 

Omitting the subindex k, and denoting WA k = A k {i) = tr(^4fc), WB k = ^kij) = tr(B k ), W = 
Y, C £c,v£cA k {c)B k (v) We show the following bound in In Appendix [A], by bounding the denominator 

pr( m > A(y)B(x) + A( y )B(,) + A(y)B(x) + A(y)B(,) 

2MNW + 22MW A W B 

4.1 Auxiliary Lemmas 

We show that if A k is too skewed, then for certain values of y, y, Alice has a good chance of failing the 
SWAP test. Formally: 

Lemma 4.1. Assume A(y) > pA{y), p > 1. Then for any assignment T, the probability that the 
verifier will catch Alice cheating in the SWAP test is at least ^ — 
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The proof is found in Appendix [Bl as it is somewhat technical. The intuition is that the super- 
operator which acts on the state diminishes the entanglement between B\ and H™. Therefore, this is 
true for any assignment Alice will send in the second round of the protocol. 

If the condition of lemma I4~T1 holds . we say that the measurement p-damaged the state. An analogous 
lemma holds for Bob. The following lemma is trivial: 

Lemma 4.2. If there exists asetDcYxYxXxX such that 

1. For any d = (y, y, x,x) G D we have x £ y, and either A or B p-damage d for some constant p. 

2. ^2deD P r (d\k) > €d for some constant er> 

Then at least one of the provers gets caught in the SWAP test with probability en (j^ — ■ 
In this case we say that D is an (ej),p) bad set. 

4.2 Large NMW 

Theorem 4.3. // NMW > W0MW A W B then at least one of the provers fails the SWAP test with 
probability = min { , i ^ } . 

The proof is by contradiction. We prove Lemma 14.41 which states that if A and B do not have a 
certain property then the provers have a constant probability of getting caught. We then prove that if A 
and B do have that property than either a second property holds or the provers get caught, with some 
probability. The second property implies NMW < WOMWaWb, which is a contradiction. Remember 
W = T,c&c.vec A (c)B(v). For cEC, let u(c) = E vec A(c)B(v), and for S CC, U{S) = T,ceS u ( c )- Let 

f w w) 

Si = {c:—-r< u(c) < — } 

Lemma 4.4. If there exists an index j such that *£i=o u ( s i) > W/WO and Y,Zj+i u ( S i) > W/WO, 
then the provers get caught with constant probability 6 jj^rujg > generated from a ( j ; V^2) bad set. 

The proof is found in Appendix O It follows by constructing a bad set, such that the clauses 
(and variables) in Lp^Si stand for y, x, and the clauses (and variables) in U°^j +1 Si stand for y,x, 
where we use the fact that if u{c\) > 2u{c2) for some two clauses, then either Alice damages the 
state because A{c\) > y/2A(c2), or Bob y/2 damages the state, or both of them do. We note that if 
u{c\) > 2u{c2),u{c\) > 2u(c3) it may still be the case that A(c2) > A(c{), and for each v^ S C3 and 
each v\ G c\ B{v^) > B{v\). However, taking out such tuples only diminishes the size of the bad set D 
by a factor of 36 (a factor of 9 comes from choosing one of the variables in the clause, and a factor of 
4 comes from choosing the clause). 
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If the condition of Lemma 14.41 does not hold, then there must be an index j such that U(Sj) + 
U(Sj + i) > 0.98W". Define F = Sj U Sj+i. Remembering that W A = SceG^( c )> we partition the 
clauses in F: 

T i = {ceF:^<A(c)<^} 

Lemma 4.5. If there exists an index j such that Yli=o l-^l ^ I-^I/IOO, and Yli^j+i 1^1 > 1-^1/100, i/ien 
i/ie first prover gets caught with constant probability 4 2 1 1q7 , generated from a ( 1 2 1 1Qti , 2) 6arf set 

The proof appears in Appendix [Cj It is very similar to the one of Lemma 14.41 but much simpler. 
As before, if the condition of Lemmas 14.41 and 14.51 do not hold, then 



3i : \Ti\ + |T i+1 | > 0.98|F| > 0.98 2 M > 0.96M 
Let G = Ti U Ti + \. As G C F, and as Vci, C2 € F : u(c\) < 4u(c2) we have 

U(G) > 0.25 • 0.98t/(F) > 0.25 • 0.98 2 W (3) 
Note ^2 c& g^2 v£c B(v) < 5Ws, as each variable appears 5 times. Also, since VcG G: j4(c) > W^/2 l+1 

0.96M^ < ^|G| < £ A(c) < W A (4) 

cGG 

Putting this together, we get 

0.25 • 0.98 2 # < U(G) = Y, u(c) = £ £ i[c]B[,] < ^ E |z^M = 

ceG ceG uec cgg uec 

4^^^ 20W A W B © 20W A W S 20W A W B 

— — — > > B\v\ < — < < 

2«+i L J - 2i+ i - Q.96M ~ 0.967V 

ceG f£c 

This is a contradiction to MNW > 100MW A W B - This proves Theorem H31 
4.3 Small IVMf 

In this subsection we handle those values of k for which the premise of Theorem 14.31 does not hold, 
i.e., A^Miy < IOOMWaWb- Define # = {c G C : < A(c) < For a set 5 C C, let 

W(5) = ^cesA(c). 

Lemma 4.6. 7/ NMW < IOOMWaWb and there exists an index i such that 

i— 1 oo 

Y W(Sj) > 7 10- 4 I^4 /\ Y 1^1 > 7 10_4m ( 5 ) 
i=o i=j+i 

2 2 

i/ten ^4/ice is caught cheating with probability 2 6-io ia ? generated from a ( 7 4 7 ioio ; 2) 6ad set. 
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The proof is found in Appendix [Dj It is very similar to that of Lemma 14.51 

Lemma 4.7. If NMW < IQOMWaWb and the second condition of Lemma \4-6\ does not hold, then 
there exists an index i such that for F = Si U S^i we have 

\F\ > (1 - 0.0002 7 )M /\ W{F) > (1 - 0.0002 7 ) W A /\ Vc G F : A{c) > ^ 

Again the proof is found in Appendix [Dj Using B instead of A, we define the sets Tj analogously to 
S l : T 8 = {,ey : Wb_< B (v)<^} 

2 2 

Lemma 4.8. Either Bob gets caught cheating with probability 3 g! l0 n which is generated from a 1 ^qii ? 2 
bad set, or else there exists an index i such that for G = Tj U Tj + i we have \G\ > (1 — 0.00027)Af, 
E veG B(v) > (1 - 0.0002 7 )Ty B and for each v G G, B(v) > 

The proof is very similar to the argument for Alice. It is found in Appendix [Dl 

Let H = {c G F : \/v £ c, v G G}. As \G\ > (1 — 0.00027)iV, and each variable appears 5 times 
we have \H \ > (1 - 0.00027)M - 5 • O.OOO27N > (1 - 0.0027)M. We now prove that a good success 
probability for Alice and Bob implies a good success probability for the provers in the classical game, 
with no communication. As the classical success probability is bounded, this will give a bound for the 
quantum success probability. Before we begin, we go over the classical setting. 

4.3.1 Classical Setting 

Let Charlie and Diana be two classical provers who are faced with a classical verifier. The verifier sends 
Charlie a random clause c, and Diana a random variable v which appears in c. Charlie should answer 
with the values that some satisfying assignment gives the variables in c, and Diana should answer with 
the value that same assignment gives v. If the original formula is 7-distant from being satisfiable, then 
the success probability of Charlie and Diana is bounded by 1 — ^. 

We prove a reduction from the quantum case to the classical one. First, a simple lemma. 

Lemma 4.9. // (u\v) < 1/2 and \u\ = \v\ = \w\ = 1 then (u\w) > 1 - e =>• (v\w) < 1/2 + ^ - f . 

The proof follows from Taylor's approximation. A specific case: if e < 0.01 then the final term is less 
than 0.99. Finally, let FailProb(y, y, x, x, k) denote the probability that the provers failed to convince 
the verifier, given the measurement results (y, y, x, x) and k. 

Lemma 4.10. // there exists an index k, matrices A^, B^ and a set of clauses R C C such that 

1. \R\ > (1 - ei)M 

2. Vy G R : Vx G y : \{($,x) G C x V : FailProb{y , y , x , x , k) > e 3 }| < e 2 MN 

3. e 3 < 1/200 
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then there is a classical strategy for Charlie and Diana which gives them a success probability of at least 
(l-ei)(l-e 2 )(l-e 3 )(l- 200e 3 ) 2 . 

Proof. Charlie gets as an input a clause y from the verifier. He chooses a random y, and simulates 
Alice, conjugating by A^. Then he finds the closest possible legal classical description to the state, by 
choosing T(y),T(y) to maximize the fidelity. Similarly, Diane simulates Bob with her input x. 

The classical verifier chooses independently, and therefore with probability at least 1 — e\ he chooses 
a clause from R. With probability greater than 1 — 62 the provers choose a pair y, x for which Alice 
and Bob have good success probability. If this is the case, Alice and Bob's success probability is at 
least 1 — 63. Since Alice passes the SWAP test with probability 1 — 63, the state she sends in the 
first step must pass the SWAP test with the classical description she sent in the second step with 
probability 1 — e%. If the latter is not the closest possible classical description, then her probability 
of failing the SWAP test, using 5 = 0.99 to ensure that there are no closer alternatives, is at least 
(1 - <5 2 )/2 > (1 - 0.99 2 )/2 > 1/200. Thus, the probability that this occurs is bounded by 200e 3 . So 
with probability at least 1 — 200e3 Alice and Charlie send the same assignment; given that, there is only 
an 63 chance of failure for Charlie. Finally, the same argument as before applies to Diane (simulating 
Bob), which contributes another factor of 1 — 200e3 (the other factors have already been counted for 
both provers). □ 

3 

Lemma 4.11. If the failure probability of Alice and Bob given result k is less than 5 5 ^ 10 i3 then there 
exists a set R with the properties stated in Lemma \4-10 ' with e\ = O.OO37, e 2 = 7l0~ 3 and £3 = 7l0~ 4 . 



Proof. Since the failure probability is less than 6 qq.iqh ? we m ust have, by Theorem 14.31 that NMW < 
WOMWaWb- By Lemmas |L6l EZl and [48l we have a set H such that \H\ > (1 - 0.0027)M, and 

Vy G H : Vx G y : A{y) > W A /{5M) A B{x) > W B /(5N) 

Using ([2]), this means that for any tuple (y,y,x,x) G H 

Prfa.g.*x W >, > WAWB 



222MW a W b ~ 25MN ■ 222MW A W B 5.55 • W 3 NM 2 
Denote L(y,x) = {(y,x) : FailProb(y, y, x, x, k) > 10~ 4 7}, and iJf a n = {y G H : 3x G y : \L(y,x)\ > 
lO^^A^M}. For any clause y G -fff a n, let fail(y) G y denote the variable in y for which L(y,x) is 
maximal. We bound Alice and Bob's failure probability from below, to get an upper bound on |-fff a n| 

Pr (Provers fail to cheat) > FailProb(y, y, x, x, k) Pr(y, y, x, x\k) 

y£H iB , iu x&y (ij,x)£L(y,x) 

> ^ £ 7l0~ 4 Pr(y,y,fail(y),x : k) 

(y,x)&L{y,x) 

> iW- 4 \L( y ,f^(y))\^(y,yMi(y),x:k) 

^NMWaWb 7 2 |#faii| 



> 



E 



25NM • 10 7 • 222MW A W B M ■ 5.55 • 10 10 
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3 

Where the last inequality comes from taking a tuple in H. As Pr(The provers fail) < 5 554013 > we have 

. Tr , 7 3 M ■ 5.55 • 10 10 , , , 

< S^TuP ? " ^ 

Taking = H\H iaih we get > (1 - 0.002 7 )M - |iT fail | > (1 - 0.0037)M as required. □ 

Proof of theorem li.il Assume $ is not satisfiable, and assume by contradiction that the provers 

3 

had some strategy which would work with success probability > 1 — 5 55^ 10m • Then there has to be 

3 

a measurement result k such that the success probability given k is at least 1 — 5 55 7 10 i3 ■ However, 

3 

according to the previous lemma, either the provers are caught with probability greater than 5 s^ioia 
(which contradicts our assumption on the success probability) , or there exists a set R as in the premises 
of that lemma. However, this would imply that there is a strategy in the classical protocol with success 
probability > (1 - 0.0037)(1 - 7iCT 3 )(l - 7l0~ 4 )(l - 2OO7IO" 4 ) 2 > 1 - 7/3, which is a contradiction. 
□ 



5 Conclusions and Open Problems 

We have shown that NEXP can be recognized in a quantum MIP protocol, even if the provers have 
unlimited classical communication between them. Our protocol achieves perfect completeness and a 
constant gap. It only sends 0(log(iV)) qubits, and thus can also be used for NP-complete languages 
with a polylogarithmic communication. Some interesting questions still remain open: 

• What is the correct upper bound on the power of this proof system? Note that if the provers 
were allowed to make any joint separable measurement it would be exactly NEXP. Does adding 
provers or communication rounds help? What happens if there is just one quantum round? 

• Is there a parallel repetition lemma for protocols when the provers are allowed to communicate 
with each other? The original proof of [Raz95] does not apply here. 

• What happens in the dual problem, when the provers are allowed to share entanglement but are 
not allowed to communicate? Does our protocol still work, with a different proof? 

• Does our result hold when the provers have a bounded amount of entanglement in addition to 
their communication channel? 
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A Calculating Probabilities 



Let r = (y,y,x,x). We wish to estimate Pr(r|fc). Bayes' rule gives 

Pr(/c|r) Pr(r) Pr(/c|r) Pr(r) 



Pr(r\k) 



Pr(fc) £ s Pr(A;|s)Pr(s) 



where s denotes any legal tuple s = (c, c, v, v) with c, c G C, v,v G V and v G c. As the prior 
distribution for all legal tuples is identical, we are only interested in calculating Pr(fc|s) for any legal 
tuple s = (c, c, w, v). 

In the protocol we presented, the provers first apply their measurement and get k, and then the 
verifier measures to get s. However, it is physically equivalent to assume the verifier measured first. As 
the states sent to the provers are unentangled after tracing out the verifier, we have that 

Pr(fe|a) = tr((J <g A k )p A (I <g A fc )t) • tr((7 ® £ fc )p B (7 B fc ) f ) 

Where p A is the state in H V A <g , is the state in (g i?Jf , and the identity is applied on the 
verifier's side. 

When considering states in H A ® H™ ® H A , we stick to the convention that the first m qubits define 
the verifier's private space, then next m + 3 describe the message qubits, and the last d define Alice's 
private space. We can now calculate 

8Md 8Dy SMd 8Di 

A k (y) = tv(A k (\y)(y\ I)A k ) = ^ £ A k [j, h]A k [j,h] = ^ ^ \A k [j, h}\ 2 

j=l h=8d(j/-l)+l i=l h=8(%-l)+l 

2JVcZ 2da; 2JVcZ 2di 

B k (x)=ti(B k (\x)(x\®I)B k ) = J2 E £*M]^IP] = Z} E l^b'^ll 2 

j=l h=2d(x-l)+l j=l h=2d(x-l)+l 

We now assume that the x, x is being traced out, and only look at the probabilities for y, y, generated 
from tr((7 (g A k )p A {I (g A k y). As ^4fc(y) is just the trace out of the private data and the qubits which 
fit the assignment, then A k (y) = tr((7 <g A k )pA(I <g A k )^). We are analyzing the following expression: 

tr(J M <g A 8Md p A (I M (g ^sMd) 1 ") 

Up to normalization, p A is a matrix which contains exactly four Is, arranged: (a, a), (a, 6), (b, a), (b, b). 
However, as we shall soon see, either a = b (in which case we have a single cell with a 4 in it) or else 
\a — b\ > SMd and thus, by the previous paragraph, we can ignore the off-diagonal entries. In both 
cases we can restrict our attention to the diagonal entries. 
Thus the structure of the p A matrix is: 

p = -L(\yy) + \yy)) |000><000|«yy| + (yy|)-±= |0 d )(0 d | G H$ (g (g F p A 
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Note that the term 0^ refers to element in a space of dimension d, as opposed to 000, an element in a 
space of dimension 2 3 . If y = y then obviously there is only one nonzero cell in the final matrix, on 
the diagonal. Otherwise, since \yy) is located in the cell My + y = (M + l)y, and y ^ y, they are 
differentiated (after tensoring) by at least (M + 1) ■ 8 ■ d > 8Md, as required. 

Let A fc (t) = E^ESsdC-ij+i A k \j,h]A k \j,h] = Yfj=* Eh=8d(i-i)+i \ A k[j,h}\ 2 . The probability 
that the verifier measures y, y in the modified protocol given k is 

P(y . m = m^m 

P(k\y,y)P(y,y) 
Z z - z P(k\z,z)P(z,z) 

tx{A kPy ^A\) 

Z z ,M A kPz,~zA{) 

A k (y) + A k (y) 

Y, z ^(Ak(z)+A k {z)) + Y.AMz) 

A k (y) + A k (y) 
E z ,Mk(z)+A k (z)) + Z z 2A k (z) 
A k (y)+A k (y) 
2MW Ak + 2W Ak 

where W Ak is the total weight: W Ak = J2 z A k (z). Note that if y = y we use 4A k (y) instead of 
A k (y) + A k (y). 

A.l Bounding the Denominator 

Let W Ak = ^2iA k (i),WB k = J2iB k (i),W = T, ce c,v£cA k (c)B k (v). We want to bound the denominator 



(equal unless y = y) > 



in 



p ( ~ .... (A(y) + A(y))(B(x)+B(x)) 
Pi(y,y,x,x\k) = — — — — — 

£c,5eC > t,ec,t;ev Pr ( c > c > u H*0 

Note that if c = c, then tr((7 <g) A k )p A (I A k )^) = 4A k (c). However, when c / c, we account this 
twice (because any of them can be considered first in the sum). Thus, the denominator becomes 

^2Y,(Mc)+A k (c))(B k (v)+B k (v)) + 2( E + E )+ 4 E ( 6 ) 

c,c vEc,v \ c=c,v,v c,c,v=v J c=c,v=v 

where all the sums are on (A k (c) + A k (c))(B k (v) + B k (v)), and factors of two and four come from c = c, 
and v = v. We begin by bounding the first two sums (which will contribute most of the weight). We 
omit the subindex k. 
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Y Y (A(c) + A(c))(5( W ) + B(v)) =J2J2 A (c)B(v) + A{c)B{v) + A(c)B(v) + A(c)B(i 



c,c v£c,v c,c v£c,v 

We now look at each of the four terms separately: 



Y Y A (c)B(v) = MN Y A(c)B{v)MNW 



C,C VdC,V vGc,v 

Y Y A (c)B(v) = 3M Y A (c)B(v) = 3MW A W B 

c,c v£c,v cGCjCGV 

Y Y A (c)B{v) = $NW a Wb < 5MW A W B 

C,C VdC,V 

And E c ,cE„ ec ,c A(c)B(v) = 3MW A W B . We used the fact that $ is 3 - SAT, and that each variable 
appears exactly 5 times. 

We return to bounding the sums in ([6]). By fixing c, we get that if c = c the second sum is bounded, 
relative to the first, by a factor of 2/M. Fixing v, we can bound the third sum by a factor of 2/N. 
Fixing both, the fourth sum is bounded by a factor of 4/(MN). We get an overall bound for the 
denominator of: 

(MNW + 3MW A W B + 5NW A W B + 3MW A W B )(1 + 2/M + 2/N + 4/ (MAT)) 
Since M and N are arbitrarily large, and M > N, we deduce our bound: 

2(MNW + UMWaWb) 

which finally gives 

p , ~ -i M ^ Mv)B(x) + A(y)B(x) + A{y)B(x) + A{y)B{x) 

ri{y, y, x, x\k) > = 

2MNW + 22MW A W B 

B Proof of Lemma 14.11 

Lemma 14. 1 1 Assume A(y) > pA(y), p > 1. Then for any assignment T, the probability that the verifier 
will catch Alice cheating in the SWAP test is at least | — j^-- 

Proof. Let a = trj ^^ffg^ , and |V>> = 1/ V2{\yy)\T{y)) + |yy)|T(y)». Taking 5 = s/WW) 

the fidelity between \ip) and p, the SWAP test has probability at least 1 g to distinguish between them 
[BCWWOlj . 
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To calculate a, we utilize the result in Appendix Since p consists of four elements in a rectangle 
((8M + 8)y, (8M + 8)y), ((8M + 8)y, (8M + 8)y), ((8M + 8)y, (8M + 8)y), ((8M + 8)y, (8M + 8)y), 
differentiated by a distance of at least 8M, the nondiagonal elements do not contribute to the trace. 

For a given assignment T(y) G {0, l} 3 and T{y) £ {0, l} 3 , let = l/y /2(\yy)\T(y)) + \yy)\T{y))). 
The fidelity between the pure state ip and the quantum state is y (ip\a\tp) • 

IV 7 ) is an equal superposition of two base vectors, one corresponding to the base state \yyT(y)} and 
the other to \yyT{y)). Thus the multiplication is effectively the sum of four elements arranged in a 
rectangle (multiplied by 1/2). To calculate each of these four elements, we turn to Appendix[A] Since, 
in the tensor product I (g) Ak, any cell whose two coordinates differ by at least 8M is zero, we can 
simplify and get: 



a[yyT(y),yyT(y)} = tv(A\yT(y))(yT(y)\A) 
a[yyT(y),yyT(y)} = ti(A\yT(y))(yT(y)\A) 

We write the elements, sticking to the convention that the first m qubits describe the verifier's 
private space, the next m fit the clause in the message space and the last three fit the value of the 
assignment: 



d d 

a(8My + 8y + a,8My + 8y + a) = J2J2\A[8dy + da + i,8dy + da + j}\ 2 

i=l j=i 

<r((8M + 8)y + b, (8M + 8)y + b) = ^2^\A[8dy + db + i,8dy + db + j]\ 2 

i 3 

a((8M + 8)y + a, (8M + 8)y + b) = ^ ^ A[8dy + da + i, 8dy + da + j]A[8dy + db + i, 8dy + db + J] 

i 3 

a((8M + 8)y + b, (8M + 8)y + a) = ^ ^ A[8dy + db + i, 8dy + db + j]A[8dy + da + i, 8dy + da + J] 

i 3 

Note that as AA^ is a measurement operator, we have that A(y) < 1, so A(y) < 1/p. Now calculating, 
reindexing by s = 8My + 8y + T(y) and t = 8M y + 8y + T(y), and folding the sum into the expression, 
we get: 

\a[s, s] I 2 + \a[t, t]\ 2 + ajs, t]a[t, s] + a[t, s]a[s, t] A{y) + A(y) + 2^ A{y)A{y) 

2{A(y)+A(y)) ~ 2{A(y) + A {y)) 

1 y/A(y)A(y) 
2^ A{y)+A(y) 

The last inequality follows from the AM-GM inequality. More precisely, since the ratio is at least p, the 
extreme value is achieved when it is exactly p, which (when substituting) gives what we need. When 
p > y/2, this gives l/2+2 1 / 4 /(l+V2) < 0.993, as required. Whenp > 2, we get 1/2-^2/3 < 0.975. □ 
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C Proofs for Lemmas 14.41 and 14.51 



Remember that for c£ C, u(c) = T, v£c A(c)B(v ), and for S C C, U(S) = J2ces u ( c )- We also defined 

[ w w) 

S i = { C :-—< u{c) < — } 

Lemma S3! // there exists an index j such that YjiZo U(Si) > W/WO and Yntj+i U(Si) > W/WO, 
then the provers get caught with constant probability 6 gg^oa > generated from a ( 4S \ i , V2) bud set. 

Proof. We construct such a bad set D. For any clause c in variables vi,V2,v$, let vmax(c) denote the 
variable Uj £ c such that B\vi\ = m&yi{B[vj\ : j = 1,2,3}, and define vmin(c) analogously. Let S np = 
U^Z Si, and S^own = U^ +1 5i. As U(Sdown) > W/100, and Sdown consists of "light" clauses, we must 
have l^downl > M/100. Partition Sdown arbitrarily into two sets Si and S r , such that \Si\, \ S r \ > M/200. 
The idea is that each clause in S np will contribute \Si\ ■ \S r \ elements to D. 

For each c up G S up ,ci E Si,c r S S r , we have u(c np ) > 2u(ci) , u(c up ) > 2u(c r ). Taking the maximal 
element in the sum for c up , and the minimal element for q, c r , we get: 

A(c up )5(vmax(c up )) > 2A(q)5(vmin(q)) 
A(c up )-B(vmax(c up )) > 2A(c r )-B(vmin(c r )) 

Assume WLOG that A(q) < A(c r ). Then 

A(c up )i?(vmax(c up )) > 2A(q)-B(vmin(c r )) 

So in the tuple (c up , q, vmax(c up ), vmin(c r )) at least one of the provers damages the state by at least 
v2. We add this tuple to D. Note that we have added a (distinct) element to D for each of the \ Si \ ■ \S r \ 
choices of q, c r , as desired. Let D up denote the elements contributed to D by c up . 

The next step is to prove that D has constant probability. Note that under the conditions of the 
lemma, we have 

Pr(y, y, x, x\k) < 22MW A W B + 2NMW < ANMW 

V >$GC ',x£y ,x£V 



7 



y,x,x):k) = E E Pr((c up) max ( c up)> ^) : 

(y,y,x,x)eD c up (y,x)eD(c upa ) 

* 7^17 £ £ ^u P )B(max(c up )) 



4JVMW 

c up (y,i)eD(c U p) 



> 4^^^ I 5 ' I " l^l E ^(cu P )^(max(c up )) 

Cup 

—\Si\-\S r \'S^u(c U r,)/3 



> -—15/1 • ISJW7300 

4NMW 

1 M M W 

> 



(because M > N) > 



ANMW 200 200 300 

NMW 

4NMW ■ 200 • 200 • 300 
1 



4.8 • 10 7 



□ 



Remember that F = Sj U Sj+i and T{ = {c £ F : < A(c) < ^fr}- We wish to prove 
Lemma 14.51 If there exists an index j such that YllZo 1-^*1 > 1-^1/100, X^j+i 1^*1 > | -P^l / 100, 
then the first prover gets caught with constant probability 4 ^ 1q 7 , generated from a ( 1 2 1 10<i , 2) 6ae? set 

Proof. Let T up = U^ =0 Tj, T down = U^ J+1 Tj. Note that any clause from T up at least 2-damages 
any clause in T down . Take D = U Cupe r up {{c U p} X T down x {vmax(c up )} x V}. Note that |T down | > 

0.98A//100 > M/200, and as T up C F, we have U(T np ) > > and thus 

1 W 1 

Pr(D) > — |T down |iV— - > 



4NMW 1500 " 1.2 -10 6 

□ 



D Proofs for Lemmas 14. 6L 14.71 and 14.81 

The proofs in this appendix are very similar and very easy. We recall some definitions, then state the 
lemmas. Define Si = {c G C : §fr < A(c) < ^}. For a set S C C, let = S ceS ^(c). 

Lemma 14.61 If NMW < WOMWaWb and there exists an index i such that 

i—1 oo 

J2 W ( S i) >jW~ 4 W A /\ E |^|>7l0- 4 M 

3=0 3=i+l 
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then Alice is caught cheating with probability 2 6-io ia ; generated from a ( 7 4T101" > 2) 6ac? set 

Proo/. Let S" up = UppS,-, S dawn = U£L i+1 S,-. Let D = U ceSup U„ ec {c} x 5 down x {v} x V. Every 
(y,y,x,x) E D is 2-damaged by Alice. On the other hand, 

Pr , ~ -, M 9 (A(y) + A(y))(B(x)+B(x)) A(y)B(x) A(y)B(x) 

rr{y,y,x,x\K) ^ — T777TT?7 — , , TI , Tir ^TT7TT?7 — 



22MW A W B + 2NMW 22MW A W B + 2NMW 222MW A W B 
Summing this over D gives 

P (D) > V V V V A ^ B W > V 3 • W- 4 lMW B A(y) 3 7 2 W A 7 2 

r v J - Z> Z> 222MW A W B ~ ^ 222MW A W B ~ 222 ■ 10 S W A ~ 7 A ■ 10 10 

2/eSup x&y ye5 down xev ye Sup 

□ 

Lemma 14.61 If NMW < 100MW A W B and the second condition of Lemma \4-6\ does not hold, then 
there exists an index i such that for F = S{ U S%+\ we have \F\ > (1 — 0. 0002^) M /\W(F) > (1 — 
O.OOO27) W A A Vc G F : A(c) > f^f . 

Proof. Choose t to be the smallest index for which the first half of the condition does hold, i.e., 
Ylj^o W(Sj) > 7lO _4 Vl^4. Then the second half of the condition cannot hold, i.e. 

00 

I 5 ? I ^ 7lO _4 M 

j=t+i 

Take i = t — 1 (note that t 7^ because otherwise the first half of the condition does not hold) . So: 

i— 1 00 i— 1 

\Si\ + ISi+il = M - Y \Sj\ - Yj \ S i\ ^ M ~Y1 \ S d\ ~ 7 10_4m >M- 7 10" 4 M - 7 10" 4 M 

j=0 j=i+2 j=0 

where the last inequality follows since the total weight S}=o^(^i) < 7lO _4 W / A, but each clause in 
the SjS contributes at least 2~ % W A to W(Sj) while each clause outside of the SjS contributes at most 
2~ % ~ l W A . A similar argument now applies to the weight W(Sj) + W(Si+i). Finally, for each c E F we 

hA ' V A( v . fl - 0.0002 7 )W^ ^ 

A(c) > — : — r~ > > 

v ; - A\F\ ~ AM ~ 5M 

□ 



Remember Sf. = G V : |& < < We now prove 



Lemma l4.8L Either Bob gets caught cheating with probability 3 9 7 10 i2 which is generated from a 1 ^ u , 2 
6ad set, or else there exists an index i such that for G = Tj U li+i we /taue |G| > (1 — 0.00027)iV, 
T, veG B(v) > (1 - 0.00027)Ty B and /or eac/i v £ G, B{v) > . 
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Proof. If no such index exists then there is a separating index i such that letting T up = U^^Sj, 
Tdown = UjU+iSj, we have EveT up B ( v ) > W~ 4 Wb, \T dowIl \ > lQ'^N. Let D = U veTup U c:vGc {c} x 
C x{v} x T down . 



P (D • k) > V A ^ B ^ > V ^ NWaB ^ > ^ NWb > 1 2 M 7 2 

T[ ' ' ~ ^ 222MW A W B ~ ^ 222MW A W B ~ 2.22 ■ 10 10 MW A ~ 1.1 ■ 10 n M 1.1 • 10 11 

(y,x,y,x) x£T up 

where we used the fact that each variable appears in the formula 5 times. □ 
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